@absolutejs/auth 0.45.8 → 0.46.0

package/dist/index.js

@@ -10005,7 +10005,8 @@ var samlSsoRoutes = ({
     }
     const metadata = await samlAdapter.getServiceProviderMetadata({
       acsUrl: acsUrlFor(request.url, organizationId),
-      connection
+      connection,
+      sloUrl: sloUrlFor(request.url, organizationId)
     });
     return new Response(metadata, {
       headers: { "content-type": "application/xml" }
@@ -10045,7 +10046,13 @@ var samlSsoRoutes = ({
   }).get(sloRoute, async ({
     cookie: { user_session_id },
     params: { organizationId },
-    query: { RelayState, SAMLRequest, SAMLResponse },
+    query: {
+      RelayState,
+      SAMLRequest,
+      SAMLResponse,
+      SigAlg,
+      Signature
+    },
     redirect,
     request,
     status,
@@ -10056,11 +10063,15 @@ var samlSsoRoutes = ({
       return status("Not Found", "No SAML connection is configured for this organization");
     }
     const sloUrl = sloUrlFor(request.url, organizationId);
+    const signedQueryString = new URL(request.url).search.replace(/^\?/, "");
     if (isNonEmptyString(SAMLResponse)) {
       const responseSettled = await settle(samlAdapter.validateLogoutResponse?.({
         connection,
         relayState: RelayState,
         samlResponse: SAMLResponse,
+        signature: Signature,
+        signatureAlgorithm: SigAlg,
+        signedQueryString,
         sloUrl
       }) ?? Promise.resolve());
       if (!("error" in responseSettled)) {
@@ -10083,6 +10094,9 @@ var samlSsoRoutes = ({
       connection,
       relayState: RelayState,
       samlRequest: SAMLRequest,
+      signature: Signature,
+      signatureAlgorithm: SigAlg,
+      signedQueryString,
       sloUrl
     }));
     if ("error" in requestSettled) {
@@ -10118,7 +10132,9 @@ var samlSsoRoutes = ({
     query: t29.Object({
       RelayState: t29.Optional(t29.String()),
       SAMLRequest: t29.Optional(t29.String()),
-      SAMLResponse: t29.Optional(t29.String())
+      SAMLResponse: t29.Optional(t29.String()),
+      SigAlg: t29.Optional(t29.String()),
+      Signature: t29.Optional(t29.String())
     })
   });
 };
@@ -25475,25 +25491,52 @@ var STANDARD_PROFILE_KEYS = new Set([
   "sessionIndex",
   "spNameQualifier"
 ]);
-var createNodeSamlAdapter = async () => {
+var DEFAULT_NAMEID_FORMAT = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+var siblingEndpoints = (urls) => {
+  const acsUrl = urls.acsUrl ?? urls.sloUrl?.replace(/\/slo(\?|$)/, "/acs$1");
+  const sloUrl = urls.sloUrl ?? urls.acsUrl?.replace(/\/acs(\?|$)/, "/slo$1");
+  return { acsUrl, sloUrl };
+};
+var createNodeSamlAdapter = async (options = {}) => {
   const { SAML } = await import("@node-saml/node-saml");
-  const build = (acsUrl, connection) => {
-    const spEntityId = new URL(acsUrl).origin;
+  const {
+    signatureAlgorithm = "sha256",
+    spCertificate,
+    spPrivateKey
+  } = options;
+  const canSign = spPrivateKey !== undefined;
+  const build = (connection, urls) => {
+    const { acsUrl, sloUrl } = siblingEndpoints(urls);
+    const baseUrl = acsUrl ?? sloUrl;
+    if (baseUrl === undefined) {
+      throw new Error("node-saml adapter requires an acsUrl or sloUrl to build a SAML client");
+    }
+    const spEntityId = new URL(baseUrl).origin;
     return new SAML({
       audience: spEntityId,
-      callbackUrl: acsUrl,
+      callbackUrl: acsUrl ?? baseUrl,
       entryPoint: connection.config.idpSsoUrl,
       idpCert: connection.config.idpX509Cert,
       issuer: spEntityId,
       logoutUrl: connection.config.idpSloUrl,
-      wantAssertionsSigned: true
+      wantAssertionsSigned: true,
+      ...canSign ? {
+        logoutCallbackUrl: sloUrl ?? baseUrl,
+        privateKey: spPrivateKey,
+        signatureAlgorithm
+      } : {}
     });
   };
-  return {
-    createAuthorizationUrl: ({ acsUrl, connection, relayState }) => build(acsUrl, connection).getAuthorizeUrlAsync(relayState ?? "", undefined, {}),
-    getServiceProviderMetadata: ({ acsUrl, connection }) => build(acsUrl, connection).generateServiceProviderMetadata(null),
+  const adapter = {
+    createAuthorizationUrl: ({ acsUrl, connection, relayState }) => build(connection, { acsUrl }).getAuthorizeUrlAsync(relayState ?? "", undefined, {}),
+    getServiceProviderMetadata: ({ acsUrl, connection, sloUrl }) => build(connection, {
+      acsUrl,
+      sloUrl
+    }).generateServiceProviderMetadata(null, spCertificate ?? null),
     validateAssertion: async ({ acsUrl, connection, samlResponse }) => {
-      const { profile: profile2 } = await build(acsUrl, connection).validatePostResponseAsync({ SAMLResponse: samlResponse });
+      const { profile: profile2 } = await build(connection, {
+        acsUrl
+      }).validatePostResponseAsync({ SAMLResponse: samlResponse });
       if (!profile2) {
         throw new Error("SAML response contained no assertion profile");
       }
@@ -25512,6 +25555,81 @@ var createNodeSamlAdapter = async () => {
       return result;
     }
   };
+  if (!canSign)
+    return adapter;
+  return {
+    ...adapter,
+    createLogoutRequestUrl: ({
+      connection,
+      nameId,
+      relayState,
+      sessionIndex,
+      sloUrl
+    }) => {
+      const saml = build(connection, { sloUrl });
+      return saml.getLogoutUrlAsync({
+        issuer: new URL(sloUrl).origin,
+        nameID: nameId,
+        nameIDFormat: DEFAULT_NAMEID_FORMAT,
+        sessionIndex
+      }, relayState ?? "", {});
+    },
+    createLogoutResponseUrl: ({
+      connection,
+      inResponseTo,
+      nameId,
+      relayState,
+      sloUrl
+    }) => {
+      const saml = build(connection, { sloUrl });
+      return saml.getLogoutResponseUrlAsync({
+        ID: inResponseTo,
+        issuer: new URL(sloUrl).origin,
+        nameID: nameId ?? "",
+        nameIDFormat: DEFAULT_NAMEID_FORMAT
+      }, relayState ?? "", {}, true);
+    },
+    validateLogoutRequest: async ({
+      connection,
+      relayState,
+      samlRequest,
+      signature,
+      signatureAlgorithm: sigAlg,
+      signedQueryString,
+      sloUrl
+    }) => {
+      const saml = build(connection, { sloUrl });
+      const { profile: profile2 } = await saml.validateRedirectAsync({
+        RelayState: relayState,
+        SAMLRequest: samlRequest,
+        SigAlg: sigAlg,
+        Signature: signature
+      }, signedQueryString ?? "");
+      return {
+        nameId: profile2?.nameID,
+        relayState,
+        requestId: profile2?.ID,
+        sessionIndex: profile2?.sessionIndex
+      };
+    },
+    validateLogoutResponse: async ({
+      connection,
+      relayState,
+      samlResponse,
+      signature,
+      signatureAlgorithm: sigAlg,
+      signedQueryString,
+      sloUrl
+    }) => {
+      const saml = build(connection, { sloUrl });
+      await saml.validateRedirectAsync({
+        RelayState: relayState,
+        SAMLResponse: samlResponse,
+        SigAlg: sigAlg,
+        Signature: signature
+      }, signedQueryString ?? "");
+    }
+  };
 };
 // src/sso/inMemorySamlServiceProviderStore.ts
 var createInMemorySamlServiceProviderStore = () => {
@@ -25905,7 +26023,7 @@ var auth = async ({
   const auditedOnCallbackSuccess = auditEmit ? composeCallbackAudit(onCallbackSuccess, auditEmit) : onCallbackSuccess;
   const auditedOnRevocationSuccess = auditEmit ? composeRevocationAudit(onRevocationSuccess, auditEmit) : onRevocationSuccess;
   const auditedOnSignOut = auditEmit ? composeSignOutAudit(onSignOut, auditEmit) : onSignOut;
-  return new Elysia39().use(sessionCleanup({
+  const composedAuth = new Elysia39().use(sessionCleanup({
     authSessionStore,
     cleanupIntervalMs,
     maxSessions,
@@ -26000,6 +26118,7 @@ var auth = async ({
     ...htmx,
     authSessionStore
   }) : new Elysia39);
+  return composedAuth;
 };
 export {
   writeWarrant,
@@ -26434,5 +26553,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=CF175090287D988A64756E2164756E21
+//# debugId=85B7840BC5CF820764756E2164756E21
 //# sourceMappingURL=index.js.map